CVE-2026-84927: EmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification
The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users with the Contributor role and above to modify a site-wide store, deleting entries an administrator configured and injecting their own, which are rendered publicly across the site.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
EmbedPress (WordPress plugin)to a version that resolves this vulnerability.Fixed in 4.6.4
Event History
Frequently Asked Questions
Who can exploit this issue?
Any authenticated WordPress user with the Contributor role or a higher-privileged role can exploit the affected REST API route. Unauthenticated visitors are not identified as able to exploit it by the available information.
What can an attacker change?
An eligible user can modify the site-wide Google Reviews store, delete entries configured by an administrator, and inject their own entries. The injected entries are rendered publicly across the site.
Which installations are affected?
Sites using EmbedPress versions before 4.6.4 are affected. The available information does not state whether any particular EmbedPress configuration is required.